1. Introduction

Stride ("Stride," "we," "our," or "us") is a marathon training and community application for iOS. We built Stride to help runners choose a marathon plan, map it to a specific race date, track training, and connect with runners preparing for the same race.

This Privacy Policy explains what personal information we collect when you use the Stride app and website (collectively, the "Services"), why we collect it, how we use and protect it, and the rights available to you depending on where you live.

By downloading or using the Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please do not use the Services.

2. Who We Are (Data Controller)

For purposes of applicable privacy law, the data controller is:

Stride Stride Labs, LLC Email: hello@downloadstride.com

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, the entity above acts as the data controller responsible for your personal data.

3. Information We Collect

We collect information in three ways: information you provide directly, information generated by your use of the app, and information collected automatically by your device or our systems.

3.1 Information You Provide

| Category | Examples | |---|---| | Account information | Email address and password (or authentication credentials via Sign in with Apple) if you create an account | | Profile information | Display name, Name, Age, Gender, Weight (if you choose to provide them) | | Running & fitness data | Runs and workouts, distance, pace, session duration, completion status, and notes you enter during or after training | | Training plan and race data | Selected marathon, race date, recent training inputs, weekly schedule, assigned sessions, and plan progress | | Purchase and subscription data | Subscription product, billing period, purchase status, renewal status, and transaction identifiers. Payment-card details are collected and processed by our payment provider, not stored by Stride. | | Community content | Posts, photos, reactions, comments, and other content you choose to share through community features | | Communications | Messages you send us through support or feedback channels |

3.2 Information Collected Automatically

| Category | Examples | |---|---| | Device information | Device model, operating system version, unique device identifiers, app version | | Usage data | Features accessed, screens viewed, in-app actions, session frequency and duration, crash logs, error reports | | Performance data | Diagnostic and telemetry data used to identify and fix bugs | | Website advertising measurement data | Page visits, browser and device information, Meta cookies or similar identifiers, and limited conversion data such as whether a paid subscription started, its billing period, value, and currency. We do not send Meta your name, email, quiz answers, race, training data, or health data. You can turn this measurement off through Privacy choices. | | Website session replay data | When you open the plan finder, PostHog records privacy-filtered page changes, clicks, and funnel events through account creation and checkout so we can find usability problems. Quiz-answer text, typed inputs, account credentials, payment fields, training-plan details, and one-time app links are masked or blocked. Cross-origin payment frames are not recorded. You can turn this measurement off through Privacy choices. |

3.3 Location Data

The Stride app does not currently collect precise GPS location data in the background. If a future version of the app introduces GPS-based tracking (e.g., for outdoor running routes), we will update this policy and obtain appropriate consent.

3.4 Health & Fitness Data

Running and workout metrics you log — such as distance, pace, duration, and completed training sessions — may constitute health-related and fitness data. This data is treated with heightened care as described throughout this policy.

Health App Integration: If you choose to connect Stride to the Health app, we may read your workout data in accordance with your device permissions. We will never use Health app data for advertising or sell it to third parties. Health app data is used solely to provide and improve the Services.

3.5 Information We Do Not Collect

We do not collect:

Social Security numbers, government-issued ID numbers, or financial account information
Precise background location without your explicit permission
Biometric identifiers

4. How We Use Your Information

We use the information we collect for the following purposes:

To provide and operate the Services Deliver core app functionality including marathon plan matching, calendar mapping, workout logging, progress tracking, and race-based community features.

To sync and store your data If you are signed in, we store your workout history and training plans so they persist across devices.

To improve the Services Analyze usage patterns and performance data to fix bugs, improve features, and develop new functionality.

To measure advertising Determine whether a Meta ad led to a visit or paid subscription and measure advertising performance.

To improve the website plan finder Review privacy-filtered session replays and funnel events to understand where runners encounter errors or abandon plan creation, account creation, or checkout.

To communicate with you Respond to support requests, send important notices (e.g., changes to this policy or Terms of Service), and, with your consent, send product updates or marketing communications.

To process purchases and manage subscriptions Confirm purchases, provide paid features, manage subscription status, support billing, and prevent payment fraud.

To ensure security and prevent fraud Monitor for abuse, enforce our Terms of Service, and protect the integrity of the Services.

To comply with legal obligations Retain and disclose information as required by applicable law.

5. Legal Basis for Processing (EEA, UK, and Switzerland)

If you are located in the EEA, the United Kingdom, or Switzerland, we process your personal data under the following legal bases under the General Data Protection Regulation (GDPR) and applicable national laws:

| Purpose | Legal Basis | |---|---| | Providing core app functionality | Performance of a contract (Art. 6(1)(b) GDPR) | | Syncing and storing workout data | Performance of a contract (Art. 6(1)(b) GDPR) | | Improving the Services (analytics) | Legitimate interests (Art. 6(1)(f) GDPR) — balanced against your interests and rights | | Marketing communications | Consent (Art. 6(1)(a) GDPR) — you may withdraw at any time | | Meta advertising measurement on the website | Legitimate interests (Art. 6(1)(f) GDPR) — measuring advertising performance; you may opt out through Privacy choices | | PostHog session replay on the website | Legitimate interests (Art. 6(1)(f) GDPR) — improving the plan finder; you may opt out through Privacy choices, and replay runs only while the plan-creation funnel is open | | Security and fraud prevention | Legitimate interests (Art. 6(1)(f) GDPR) | | Legal compliance | Legal obligation (Art. 6(1)(c) GDPR) |

Special Category Data (Health Data): Fitness and workout data may constitute health data under GDPR Art. 9. We process this data on the basis of your explicit consent (Art. 9(2)(a) GDPR). You may withdraw consent at any time, though this will not affect prior processing and may limit your ability to use certain features.

6. How We Share Your Information

We do not sell your personal information. We do not share your personal information with third parties for their own marketing purposes. We may share information in the following limited circumstances:

Service Providers: We engage trusted third-party vendors to help us operate the Services (e.g., cloud hosting, analytics, crash reporting). These vendors process data on our behalf and are contractually prohibited from using it for any other purpose. Current categories of service providers include:

Cloud infrastructure, hosting, and data storage: Google Cloud and Vercel
Payments and subscription management: Stripe and RevenueCat
Security and abuse prevention: Cloudflare
App links and website-to-app handoff: Branch
Analytics and crash reporting: Google Analytics
Website session replay and funnel analytics: PostHog, Inc. (you can opt out through Privacy choices)
Website advertising measurement: Meta Platforms, Inc. (you can opt out through Privacy choices)

Apple: The Services are distributed via the Apple App Store and may use Apple APIs (including the Health app, Sign in with Apple, and StoreKit). Apple's privacy practices are governed by Apple's Privacy Policy.

Business Transfers: If Stride is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change via email or prominent notice in the app prior to your data being transferred.

Legal Requirements: We may disclose information if we believe in good faith that such disclosure is required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of Stride, our users, or the public.

7. Data Retention

We retain your personal information for as long as necessary to provide the Services and fulfill the purposes described in this policy, unless a longer retention period is required or permitted by law.

| Data Type | Retention Period | |---|---| | Account & profile data | Until account deletion, plus 30 days for backup purposes | | Workout & training data | Until account deletion | | Purchase & subscription records | For the life of the account and as required for tax, accounting, fraud prevention, and legal compliance | | Usage & analytics data | 6 months, then aggregated or deleted | | Support communications | 2 years from last contact | | Legal compliance records | As required by applicable law |

If you delete your account, we will delete or anonymize your personal data within 7 days, except where retention is required for legal compliance, fraud prevention, or dispute resolution.

8. Data Security

We implement technical and organizational measures designed to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

Encryption of data in transit (TLS/HTTPS) and at rest
Access controls limiting data access to authorized personnel
Regular security reviews of our infrastructure and code
Incident response procedures

No system is completely secure. If you believe your account has been compromised, please contact us immediately at hello@downloadstride.com.

In the event of a data breach that is likely to affect your rights and freedoms, we will notify affected users and, where required, applicable supervisory authorities within the timeframes required by law.

9. Your Rights

9.1 All Users

Regardless of your location, you may:

Access or update your workout and profile data within the app at any time
Delete your account and data by going to Profile > Delete Account.
Opt out of marketing communications by following the unsubscribe link in any email we send, or contacting us directly

9.2 EEA, UK, and Swiss Residents (GDPR Rights)

If you are located in the EEA, UK, or Switzerland, you have the following rights under the GDPR:

Right of access (Art. 15): Request a copy of the personal data we hold about you.
Right to rectification (Art. 16): Request correction of inaccurate or incomplete personal data.
Right to erasure / "right to be forgotten" (Art. 17): Request deletion of your personal data where there is no compelling reason for continued processing.
Right to restriction of processing (Art. 18): Request that we limit the way we process your data in certain circumstances.
Right to data portability (Art. 20): Receive your personal data in a structured, commonly used, machine-readable format and transfer it to another controller.
Right to object (Art. 21): Object to processing based on legitimate interests, including profiling, or to processing for direct marketing.
Right to withdraw consent: Where processing is based on consent, withdraw consent at any time without affecting the lawfulness of prior processing.
Right to lodge a complaint: Lodge a complaint with your local data protection authority. A list of EEA supervisory authorities is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en.

To exercise any of these rights, please contact us at hello@downloadstride.com. We will respond within 30 days (or as otherwise required by applicable law). We may need to verify your identity before processing your request.

9.3 California Residents (CCPA / CPRA Rights)

If you are a California resident, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) provide you with the following rights:

Right to Know: You have the right to request that we disclose:

The categories and specific pieces of personal information we have collected about you
The categories of sources from which we collected your personal information
Our business or commercial purpose for collecting personal information
The categories of third parties with whom we share personal information

Right to Delete: You have the right to request that we delete personal information we have collected from you, subject to certain exceptions.

Right to Correct: You have the right to request that we correct inaccurate personal information we maintain about you.

Right to Opt Out of Sale or Sharing: We do not sell your personal information. We may share website identifiers and internet activity with Meta for advertising measurement and cross-context behavioral advertising. Visit this Privacy Policy, select "Privacy choices," and choose "No thanks" to opt out.

Right to Limit Use of Sensitive Personal Information: To the extent your fitness and workout data constitutes "sensitive personal information" under the CPRA, we use it only as necessary to provide the Services, and you have the right to request that we limit its use.

Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.

How to Submit a Request: To exercise your California rights, please:

Email us at hello@downloadstride.com with the subject line "California Privacy Request"

We will respond to verifiable requests within 45 days. If we require more time (up to 90 days total), we will inform you of the reason and extension in writing.

Categories of Personal Information Collected (California Disclosure):

| CCPA Category | Information Collected | Business Purpose | |---|---|---| | Identifiers | Name, email address, device ID | Account management, app functionality | | Internet/Electronic Network Activity | App usage data, feature interactions, crash logs | Analytics, bug fixes, service improvement | | Health & Medical Information | Running and workout metrics (distance, pace, duration, completion) | Core app functionality | | Commercial Information | Subscription product, purchase status, and transaction history | Payment processing, subscription access, accounting, and fraud prevention | | Inferences | Training patterns derived from workout history | Personalized plan features |

We have not sold personal information in the preceding 12 months. We may share website identifiers and internet activity with Meta for advertising measurement, as described above, unless a visitor opts out.

10. Children's Privacy

The Stride app is not directed to children under the age of 13 (or 16 where required by applicable law, including in the EEA). We do not knowingly collect personal information from children under these ages.

If you believe we have inadvertently collected information from a child, please contact us at hello@downloadstride.com and we will promptly delete it.

11. International Data Transfers

Stride is operated from the United States. If you are accessing the Services from outside the United States — including from the EEA, UK, or Switzerland — your personal data may be transferred to, stored, and processed in the United States or other countries where our service providers maintain facilities.

We ensure that such transfers comply with applicable data protection laws by implementing appropriate safeguards, including:

Standard Contractual Clauses (SCCs) approved by the European Commission for transfers from the EEA to third countries
UK International Data Transfer Agreements (IDTAs) for transfers from the United Kingdom

For questions about international data transfers, please contact us at hello@downloadstride.com.

12. Cookies and Tracking Technologies

The Stride website (downloadstride.com) uses cookies and similar tracking technologies to improve the browsing experience, analyze traffic, and measure advertising. PostHog receives privacy-filtered funnel events and session replay data while the plan-creation funnel is open. Replays mask or block quiz-answer text, typed inputs, account credentials, payment fields, training-plan details, and one-time app links; cross-origin payment frames are not recorded. Meta receives page visits and limited paid-subscription conversion data for ad measurement. It does not receive your quiz answers, training data, name, email, or Stride account ID from Stride. You can turn off Meta and PostHog measurement by returning to this Privacy Policy, selecting "Privacy choices," and choosing "No thanks." You can also control cookies through your browser settings.

The Stride mobile app does not use browser cookies. We may use mobile device identifiers and third-party analytics SDKs (as described in Section 6) for analytics purposes. You can limit ad tracking through your iOS device settings (Settings > Privacy & Security > Tracking).

13. Third-Party Links and Services

The Services may contain links to third-party websites, apps, or services (such as the Apple App Store). This policy does not apply to those third-party services, and we encourage you to review their privacy policies. We are not responsible for the privacy practices of any third party.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by:

Posting the updated policy in the app with a new "Last Updated" date
Sending an email notification to your registered email address (for significant changes)

Your continued use of the Services after the effective date of any update constitutes your acceptance of the revised policy. If you do not agree to the updated policy, please delete your account and stop using the Services.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

Stride Stride Labs, LLC Email: hello@downloadstride.com